Who Determines Policies Affecting End Users?

We recently purchased an e-mail security appliance that among other things does content filtering. In testing this out, I found there are some users in our organization who love to use profanity and other inappropriate content in their e-mails.

I’m wondering who in your organization determines such things as what’s right/wrong to view on the Internet, what kind of language/content should be filtered in e-mail, etc.? Is this IT’s decision, Human Resources, or Senior Managment?